Windows EFS EUVD-2026-99359

Exploitation requires the attacker to be an authenticated/authorized principal with at least low-level privileges on the network (PR:L), targeting the Windows Encrypting File System (EFS) component reachable over the network (AV:N). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the pre-existing authentication requirement and the need for network reachability to the EFS service - this is not an unauthenticated internet-facing flaw. Affected systems are Windows builds below the patched versions listed in EUVD (e.g., Windows Server 2025 <10.0.26100.33650, Windows 11 24H2 <10.0.26100.9711, Windows Server 2016/2019/2022 and Windows 10 1607-22H2); fully patched hosts are not exploitable.

This is a credible, mid-to-high priority vulnerability but not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-level privileges and no user interaction, yielding total CIA impact (C:H/I:H/A:H) - consistent with the 8.8 base score and the RCE/CWE-94 code-injection classification. However, the exploitation signals temper this: CISA's SSVC framework records Exploitation as 'none' and Automatable as 'no', and there is no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting - high technical impact (SSVC 'Total' matches C:H/I:H/A:H) but currently no observed or automatable exploitation. The key limiting factor is PR:L: the attacker must already be an authenticated/authorized principal on the network, which narrows this from a mass-exploitable internet worm toward post-authentication lateral movement or privilege escalation. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: patch on a normal prioritized cycle (elevated for domain-joined/high-value Windows hosts), but this is not drop-everything unless internal authenticated access is part of your threat model.

An attacker who has already obtained low-privilege authenticated access on the network sends crafted input to the Windows Encrypting File System (EFS) component, exploiting improper control of code generation (CWE-94) to inject and execute arbitrary code on the target host. Because no user interaction is required and attack complexity is low, a single malicious network request from an authenticated foothold can yield full code execution. No public exploit code has been identified, so exploitation currently requires original vulnerability-research capability.